A cryptosystem is a method of disguising messages so that only certain people can see through the disguise and interpret the message. Cryptography is the art and science of creating and using cryptosystems. Cryptosystems and cryptography are often used in connection with the conduct of electronic transactions and communications such as, for example, electronic financial transactions. Basically, a cryptosystem involves the generation of an encryption key that is used to encrypt a message; only a person that has a corresponding decryption key can decipher the message.
There are two principal types of cryptosystems: symmetric and asymmetric. Symmetric cryptosystems use the same key (a secret key) to encrypt and decrypt the message. Asymmetric cryptosystems use one key (for example a public key) to encrypt a message and a different key (a private key) to decrypt the message. Asymmetric cryptosystems are also called “public key” or “public key/private key” cryptosystems.
Symmetric cryptosystems have the following inherent problem: how does one transport the secret key from the send of a message to the recipient securely and in a tamperproof fashion? If someone could send the secret key securely, then in theory he or she would not need a cryptosystem in the first place—the secure channel could be simply used to send the message. Often, trusted couriers and digital certificates are used as a solution to this problem. Another method for communicating symmetric keys (as well as messages) is the well-known RSA asymmetric public key cryptosystem, which is used in the popular security tool Pretty Good Privacy (PGP).
Another asymmetric cryptosystem is elliptic curve cryptography (ECC). This methodology, which is explained in greater detailed below, is an approach to public key/private key cryptography based on the mathematics of elliptical curves. An elliptical curve is a set of solutions (x, y) to an equation of the general form y2=x3+ax+b, which is an open curve on a graph. In contrast, a circle is a form of closed curve that graphically represents a set of solutions to an equation of the form (y−a)2=r2−(x−b)2, where a and b are coordinates of the center of the circle and r is the radius. Elliptic curves as a mathematical phenomenon have been studied for the about 150 years, but the application of elliptic curves to cryptography was proposed circa 1985 independently by the researchers Neal Koblitz and Victor Miller.
An asymmetric cryptosystem may be generally represented as an encryption function E( ) and a decryption function D( ), such that D((E(P))=P, for any plaintext P. In a public key cryptosystem, E( ) can be easily computed from a public key (PuK), which in turn is related to and computed from a private key (PrK). The public key PuK is sometimes published so that anyone having the key can encrypt messages. If the decryption function D( ) cannot easily be computed from the public key PuK without knowledge of the private key PrK, but can be computed readily with the private key, then it follows that only the person who generated the private key PrK can decrypt the messages encrypted with the public key. This is an essential useful attribute of public key/private key cryptography. The reliability of public key/private key cryptography depends on the two keys, PuK and PrK.
Public key/private key cryptography has at least three principal applications. First is basic encryption—keeping the contents of messages secret. Second, digital signatures are implemented using public key/private key techniques. U.S. Pat. Nos. 6,851,054; 6,820,202; 6,820,199; 6,789,189; and others, the disclosures of which are incorporated by reference herein, are examples of digital signature type systems that utilize aspects of public key/private key cryptography. Third, electronic authentication systems that are not based strictly on conventional digital signature techniques may be implemented with public key/private key cryptography. Some of the foregoing incorporated and referenced patents describe certain aspects of such authentication systems.
With respect to the mathematical properties of elliptic curves, it is now known that specific operations can be geometrically defined that limit the number of points on an elliptic curve to a finite set of points defining a finite cyclic group. Such an elliptic curve group can be used in conjunction with the known Elliptic Curve Discrete Logarithm Problem (ECDLP) in an encryption scheme to create an elliptic curve cryptosystem, which is generally believed to be secure and powerful given current computing technologies.
In implementing ECC and, specifically, in generating an asymmetric public-private key pair for use in the Elliptic Curve Digital Signature Algorithm (ECDSA), an elliptic curve is defined by certain “domain” parameters, and a point is chosen along the elliptic curve that serves as a generator of a finite cyclic group, all the elements of which also lie along the elliptic curve. This generator is referred to as the “generating point” or “base point” (P). The domain parameters include: the field identification (or “Field ID”) identifying the underlying finite or Galois field, traditionally represented as “F2p” or “F2m”; the curve comprising two coefficients “a” and “b” of the elliptic curve equation y2=x3+ax+b mod p; a generating point (xp, yp); and the order of the generating point “n” comprising a prime number. Optionally, the domain parameters may include other specifications, such as, for example, a bit string seed of length 160 bits—if the elliptic curve is randomly generated in accordance with governmental standards, or a cofactor. The domain parameters further may include additional specifications, such as the appropriate bit length of a key.
In certain known methodologies for ECC, after a generating point (P) specified, a first public-private key is first generated essentially by obtaining a large random number (R) from a random number generator or pseudo random number generator; and then using the random number as a “multiplier” of the generating point (i.e., P is repeatedly “added” R times) to arrive at the public key (PuK). The random number multiplier used to generate the public key is the private key (PrK) of the public-private key pair.
Those skilled in the art will appreciate that an ECC public key is an element of the finite cyclic group of the elliptic curve generated by the generating point. Furthermore, because the multiplier (PrK) used to arrive at the public key is randomly generated, the function used to first generate the public-private key pair is a nondeterministic function to the extent that the private key is unknown, i.e., not yet generated. Indeed, certain governmental standards for ECC require that the private key be generated utilizing a random number generator or pseudo random number generator. Because generation of the public-private key pair is performed using a nondeterministic function and, specifically, because the private key is generated from a random number or pseudo random number generator, at least the private key must be saved to perform later cryptographic operations with either one of the keys of the public-private key pair. (Only the private key must be saved because, if the private key is known, then the function used to generate the public key is a deterministic function of the known private key, and the public key can be generated as needed.)
As mentioned above, certain known public key/private key cryptosystems typically utilize the random number approach in key generation. However, it is believed that additional security aspects for public key/private key generation can be obtained by utilizing measures other than strictly using a random number during in the key generation algorithms. A deterministic function, as compared to a nondeterministic function, can provide security that is more than adequate for many applications, especially in an elliptic curve cryptosystem, and may provide certain benefits not available in nondeterministic key generation approaches. For example, a deterministic function may be used to assist in securely storing a private key in an electronic device, or in generating a public key/private key pair for use in an “on demand” cryptographic operation in a computer system that itself may not be capable of storing or protecting the private key from access by potential eavesdroppers. Furthermore, a deterministic function can extend the usability of a public/private key pair by making a single private key useable by multiple parties while still being able to show intent between the two parties.
In utilizing ECC—or any other cryptographic system, any cryptographic key used for encryption must be protected from compromise, especially during storage. Otherwise, the integrity of the cryptographic system is jeopardized. For example, if an insecure or network-accessible computer system and/or software is used in connection with a cryptographic operation, there is a risk that the keys stored in that computer system could be obtained and improperly utilized.
One manner of securely storing a cryptographic key comprises encrypting the cryptographic key itself within a computer system as a function of a PIN, password, or passphrase of a user who is authorized to use the cryptographic key, and then to save or store the encrypted key indefinitely within the computer system. When the key is required for a particular cryptographic operation, the user must input into the computer system the PIN, password, or passphrase, which then is used to decrypt the key, and the decrypted key then is used, in turn, to perform the cryptographic operation. Thereafter, the decrypted key is deleted in the computer system, and the encrypted key remains saved or stored within the computer system for later decryption and subsequent use, as needed.
Safeguarding cryptographic keys, especially private keys in public-private key cryptographic systems, is important if adoption and use of cryptography by the general public in electronic communications is to become prevalent. The safeguarding of cryptographic keys is especially important in connection with the conduct of electronic transactions such as, for example, financial transactions. Facilitating the adoption and use of cryptography in such electronic communications—especially adoption and use of digital signatures—also is important, as demand for greater security, reliability, and accountability in such electronic communications is believed to be increasing.
However, there are applications where mere safeguarding of cryptographic keys is not sufficient to conveniently implement certain cryptographic operations, for example, when one party needs to communicate securely with multiple other parties, but still needs to differentiate the communications between the various multiple parties. A specific example of this need is a situation where a first party needs to securely communicate with a financial institution, and needs to share information with a service provider that provides services to the first party and the financial institution. Another example is a situation where a first party uses the same private key for certain encryption operations with multiple other parties, but each of the other parties is provided with and uses a different public key that is still operatively related to the same private key.
Another example of a need for different functionality in encryption operations is a situation where two different digital signatures are required in connection with an electronic transaction, where the same private key of a party is utilized, but where each different digital signature can be verified with a different public key. Such functionality would be useful in connection with record keeping and security of multiple transactions by a person with a financial institution, or in connection with record keeping and security of separate transactions with multiple other parties such as financial institutions or service providers.
Accordingly, there is a need for improved methods for securely generating and protecting cryptographic keys, especially in asymmetric public key/private key cryptosystems, and especially for cryptographic operations involving use of insecure computer systems and software, communications with multiple third parties, multiple transactions, record keeping of multiple transactions and multiple parties, and the like. Such improved methods are believed usefully for facilitating the adoption and use of cryptography for electronic communications, secure financial transactions, and in particular, the adoption and use of digital signatures in various applications.